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CLAIMS: 

1 . A method comprising: 

detecting presence of an event; 
5 receiving an inbound packet from a network; and 

selectively processing the packet using a software process or an interrupt-driven 
service routine based on the detection of the event. 

The method of claim 1 , wherein the event comprises a network attack. 

The method of claim 1, wherein selectively processing the packet comprises: 
invoking the service routine using a software interrupt when the event is not detected; 

invoking the software process using a wakeup signal 

The method of claim 1, wherein detecting the presence of an event comprises 
Lg the event based on a traffic level of inbound packets received by a router. 

A method for processing a network packet comprising: 
receiving inbound packets from a network; 
processing the packets using a software process; and 

controlling a usage rate by which the software process uses computing resources to 
the packets. 

25 6. The method of claim 5, wherein controlling the usage rate comprises determining an 
execution period that the software process has executed without a context switch. 

7. The method of claim 6, wherein controlling the usage rate comprises pausing 
execution of the software process for a sleep period when the execution period exceeds a 
30 threshold. 
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8. The method of claim 7, wherein pausing execution of the software process comprises 
dynamically adjusting the sleep period during the network attack. 

9. The method of claim 5, wherein processing the packets comprises invoking a packet 
service routine from the software process. 

10. The method of claim 5, further comprising: 

setting a rate- limiting operating mode based on a traffic level of the inbound packets; 

and 

selectively invoking the packet service routine based on the rate- limiting operating 
mode by calling the packet service routine from the software process or by issuing a software 
interrupt. 

1 1 . The method of claim 10^ wherein invoking the packet service routine comprises 
selecting a pointer to the PSR from a table of pointers to packet service routines supporting a 
number of network protocols, 

12. The method of claim 5, fiirther comprising detecting a presence of a network attack. 

13. The method of claim 12, wherein detecting the presence of the network attack 
comprises detecting the network attack based on a traffic level of inbound packets. 

14. The method of claim 12, wherein detecting the presence of a network attack 
comprises detecting a denial of service (DOS) attack. 

15. A method of processing network packets within a routing device comprising: 
selecting between a first mode of processing inbound packets using interrupt service 

routines and a second mode of processing the inbound packets using a software process 
executing within an operating environment provided by a multi- tasking operating system; 
and 
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processing a set of packets within a network routing device according to the selected 

mode. 

16. The method of claim 15, further comprising detecting a presence of a network attack, 
wherein selecting between the first and second modes comprises selecting between the first 
and second modes based on the detection of the network attack. 

1 7. The method of clahn 1 6, wherein detecting the presence of the network attack 
comprises detecting the network attack based on a traffic level of inbound packets. 

18. The method of claim 16, wherein detecting the presence of a network attack 
comprises detecting a denial of service (DOS) attack. 

19. A computer- readable medium comprising instructions for causing a programmable 
processor to: 

receive inbound packets from a network; 

process the packets using a software process executing on the progranamable 
processor; and 

control a usage rate by which the software process uses computing resources to 
process packets, 

20. The method of claim 19, wherein the instructions cause the processor to invoke a 
packet service routine from the software process, 

21. The computer- readable medium of claim 19, wherein the instructions cause the 
processor to: 

set a rate- limiting operating mode based on a traffic level of the inbound packets; and 
selectively invoke the packet service routine based on the rate- limiting operating 

mode by calling the packet service routine from the software process or by issuing a software 

interrupt. 
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22. The computer- readable medium of claim 19, wherein the instructions cause the 
processor to select a pointer to the packet service routine from a table of pointers to packet 
service routines supporting a number of network protocols. 

23. The computer- readable medium of claim 19, wherein the instructions cause the 
processor to detect a presence of a network attack. 

24. The computer- readable medium of claim 23, wherein the instructions cause the 
processor to detect the network attack based on a traffic level of inbound packets. 

25. The computer-readable medium of claim 23, wherein the instructions cause the 
processor to detect a denial of service (DOS) attack. 

26. A routing device comprising: 

a detection module to detect a presence of a network attack; 
a network interface to receive a packet from the network; and 
a routing engine to selectively process the packet using a software process or an 
interrupt- driven service routine based on the detection of the network attack. 

27. The routing device of claim 26, where the detection module includes a counter 
indicating a number of packets processed for a network protocol, wherein the detection 
module enables a rate-luniting operating mode of the routing engine when the counter 
exceeds a protocol-specific threshold. 

28. The routing device of claim 26, wherein the detection module comprises a network 
service routine invoked in response to a hardware interrupt from the network interface. 

29. The routing device of claim 26, further comprising: 

a set of packet service routines to service inbound packets in accordance with a 
plurality of network protocols; and 
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an operating system to invoke one of the packet service routines to invoke the 
software process in response to wakeup signal when the network attack is detected, and to 
invoke the software process in response to a software interrupt when the network attack is 
not detected. 

30. The routing device of claim 26, wherein the software process controls a usage rate of 
computing resources to process the packets. 

3 1 . The routing device of claim 30, wherein the software process controls usage rate of 
computing resources by determining an execution period that the software process processes 
has executed without a context switch, and pausing execution of the software process for a 
sleep period when the execution period exceeds a threshold. 

32. The routing device of claim 31, wherein the software process dynamically adjusts the 
sleep period during the network attack. 

33. The routing device of claim 26, wherein the detection module detects the presence of 
the network attack based on a traffic level of inbound packets. 

34. The routing device of claim 26, wherein detection module detects the presence of a 
denial of service (DOS) attack. 

35. The routing device of claim 36, fiirther comprising a table of pointers to the 
packet service routines. 
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